Re: [sleuthkit-users] Extracting partions from dd image

[Brian C. <ca...@sl...>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


On Mar 31, 2004, at 12:26 PM, Eagle Investigative Services, Inc. wrote:

> Brian,
>
> The process of dd'ing out the partition worked for only one image 
> file, and
> not for the three others.  All 4 image files were dd'd the same way.

Which one worked?  The first one or one of the latter ones?

> So what I did was try starting at 63 and 62, and tried ending at one 
> more
> than the end point and none of these options worked.

It could be that the file system is corrupt.  The first partition of 
almost every disk starts at sector 63, so that shouldn't be a problem.  
Make sure you are using the original disk image and not one of the 
partition images as input.  Also make sure that the 'bs=' value for 
'dd' is set to 512.

Send an 'xxd' output of the first sector of the partition image if 
nothing else works:

dd if=part-img.dd count=1 | xxd


brian
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (Darwin)

iD8DBQFAaxhQOK1gLsdFTIsRAonLAJ9AmeJM39h41j70Tp/d3r+KEDZBXQCgiH1A
7B2rcrJZ4CFtlOkX9uD5uyI=
=Kkb7
-----END PGP SIGNATURE-----